apiVersion: tekton.dev/v1 kind: PipelineRun metadata: annotations: build.appstudio.openshift.io/repo: https://github.com/redhat-appstudio-qe/hacbs-test-project-konflux-demo?rev=4e1fc4d5bd2ea44f727397aed092519e6b183a13 build.appstudio.redhat.com/commit_sha: 4e1fc4d5bd2ea44f727397aed092519e6b183a13 build.appstudio.redhat.com/target_branch: base-eopgjy pipelinesascode.tekton.dev/branch: base-eopgjy pipelinesascode.tekton.dev/cancel-in-progress: "false" pipelinesascode.tekton.dev/check-run-id: "54656439140" pipelinesascode.tekton.dev/controller-info: '{"name":"default","configmap":"pipelines-as-code","secret":"pipelines-as-code-secret", "gRepo": "pipelines-as-code"}' pipelinesascode.tekton.dev/event-type: push pipelinesascode.tekton.dev/git-auth-secret: pac-gitauth-nimlvl pipelinesascode.tekton.dev/git-provider: github pipelinesascode.tekton.dev/installation-id: "40773614" pipelinesascode.tekton.dev/log-url: https://console-openshift-console.apps.rosa.kx-b2a4a8a201.4we6.p3.openshiftapps.com/k8s/ns/konflux-uedl/tekton.dev~v1~PipelineRun/konflux-demo-component-kbyv-on-push-z779z pipelinesascode.tekton.dev/max-keep-runs: "3" pipelinesascode.tekton.dev/on-cel-expression: event == "push" && target_branch == "base-eopgjy" pipelinesascode.tekton.dev/original-prname: konflux-demo-component-kbyv-on-push pipelinesascode.tekton.dev/pull-request: "22621" pipelinesascode.tekton.dev/repo-url: https://github.com/redhat-appstudio-qe/hacbs-test-project-konflux-demo pipelinesascode.tekton.dev/repository: konflux-demo-component-kbyv pipelinesascode.tekton.dev/scm-reporting-plr-started: "true" pipelinesascode.tekton.dev/sender: rhtap-qe-bots-2 pipelinesascode.tekton.dev/sha: 4e1fc4d5bd2ea44f727397aed092519e6b183a13 pipelinesascode.tekton.dev/sha-title: 'Merge pull request #22621 from redhat-appstudio-qe/konflux-konflux-demo-component-kbyv' pipelinesascode.tekton.dev/sha-url: https://github.com/redhat-appstudio-qe/hacbs-test-project-konflux-demo/commit/4e1fc4d5bd2ea44f727397aed092519e6b183a13 pipelinesascode.tekton.dev/source-branch: refs/heads/base-eopgjy pipelinesascode.tekton.dev/source-repo-url: https://github.com/redhat-appstudio-qe/hacbs-test-project-konflux-demo pipelinesascode.tekton.dev/state: queued pipelinesascode.tekton.dev/url-org: redhat-appstudio-qe pipelinesascode.tekton.dev/url-repository: hacbs-test-project-konflux-demo results.tekton.dev/recordSummaryAnnotations: '{"repo":"hacbs-test-project-konflux-demo","commit":"4e1fc4d5bd2ea44f727397aed092519e6b183a13","eventType":"push","pull_request-id":22621}' test.appstudio.openshift.io/pr-group: refs/heads/base-eopgjy test.appstudio.openshift.io/snapshot-creation-report: BuildPLRInProgress creationTimestamp: "2025-11-06T05:42:42Z" finalizers: - test.appstudio.openshift.io/pipelinerun - results.tekton.dev/pipelinerun - pipelinesascode.tekton.dev/finalizer - chains.tekton.dev/pipelinerun generateName: konflux-demo-component-kbyv-on-push- generation: 2 labels: app.kubernetes.io/managed-by: pipelinesascode.tekton.dev app.kubernetes.io/version: v0.38.0 appstudio.openshift.io/application: konflux-demo-app appstudio.openshift.io/component: konflux-demo-component-kbyv kueue.x-k8s.io/priority-class: konflux-post-merge-build kueue.x-k8s.io/queue-name: pipelines-queue pipelines.appstudio.openshift.io/type: build pipelinesascode.tekton.dev/cancel-in-progress: "false" pipelinesascode.tekton.dev/check-run-id: "54656439140" pipelinesascode.tekton.dev/event-type: push pipelinesascode.tekton.dev/original-prname: konflux-demo-component-kbyv-on-push pipelinesascode.tekton.dev/pull-request: "22621" pipelinesascode.tekton.dev/repository: konflux-demo-component-kbyv pipelinesascode.tekton.dev/sha: 4e1fc4d5bd2ea44f727397aed092519e6b183a13 pipelinesascode.tekton.dev/state: queued pipelinesascode.tekton.dev/url-org: redhat-appstudio-qe pipelinesascode.tekton.dev/url-repository: hacbs-test-project-konflux-demo tekton.dev/pipeline: konflux-demo-component-kbyv-on-push-z779z test.appstudio.openshift.io/pr-group-sha: 0cc4d998deac4d39f83d0c41d960e0fcd603f419f4271ba55f915149b49be7 managedFields: - apiVersion: tekton.dev/v1 fieldsType: FieldsV1 fieldsV1: f:metadata: f:annotations: .: {} f:build.appstudio.openshift.io/repo: {} f:build.appstudio.redhat.com/commit_sha: {} f:build.appstudio.redhat.com/target_branch: {} f:pipelinesascode.tekton.dev/branch: {} f:pipelinesascode.tekton.dev/cancel-in-progress: {} f:pipelinesascode.tekton.dev/check-run-id: {} f:pipelinesascode.tekton.dev/controller-info: {} f:pipelinesascode.tekton.dev/event-type: {} f:pipelinesascode.tekton.dev/git-auth-secret: {} f:pipelinesascode.tekton.dev/git-provider: {} f:pipelinesascode.tekton.dev/installation-id: {} f:pipelinesascode.tekton.dev/log-url: {} f:pipelinesascode.tekton.dev/max-keep-runs: {} f:pipelinesascode.tekton.dev/on-cel-expression: {} f:pipelinesascode.tekton.dev/original-prname: {} f:pipelinesascode.tekton.dev/pull-request: {} f:pipelinesascode.tekton.dev/repo-url: {} f:pipelinesascode.tekton.dev/repository: {} f:pipelinesascode.tekton.dev/sender: {} f:pipelinesascode.tekton.dev/sha: {} f:pipelinesascode.tekton.dev/sha-title: {} f:pipelinesascode.tekton.dev/sha-url: {} f:pipelinesascode.tekton.dev/source-branch: {} f:pipelinesascode.tekton.dev/source-repo-url: {} f:pipelinesascode.tekton.dev/url-org: {} f:pipelinesascode.tekton.dev/url-repository: {} f:results.tekton.dev/recordSummaryAnnotations: {} f:generateName: {} f:labels: .: {} f:app.kubernetes.io/managed-by: {} f:app.kubernetes.io/version: {} f:appstudio.openshift.io/application: {} f:appstudio.openshift.io/component: {} f:pipelines.appstudio.openshift.io/type: {} f:pipelinesascode.tekton.dev/cancel-in-progress: {} f:pipelinesascode.tekton.dev/check-run-id: {} f:pipelinesascode.tekton.dev/event-type: {} f:pipelinesascode.tekton.dev/original-prname: {} f:pipelinesascode.tekton.dev/pull-request: {} f:pipelinesascode.tekton.dev/repository: {} f:pipelinesascode.tekton.dev/sha: {} f:pipelinesascode.tekton.dev/url-org: {} f:pipelinesascode.tekton.dev/url-repository: {} f:spec: .: {} f:params: {} f:pipelineSpec: .: {} f:description: {} f:params: {} f:results: {} f:tasks: {} f:workspaces: {} f:taskRunTemplate: .: {} f:serviceAccountName: {} f:workspaces: {} manager: pipelines-as-code-controller operation: Update time: "2025-11-06T05:42:43Z" - apiVersion: tekton.dev/v1 fieldsType: FieldsV1 fieldsV1: f:metadata: f:finalizers: .: {} v:"results.tekton.dev/pipelinerun": {} manager: watcher operation: Update time: "2025-11-06T05:42:43Z" - apiVersion: tekton.dev/v1 fieldsType: FieldsV1 fieldsV1: f:metadata: f:annotations: f:test.appstudio.openshift.io/pr-group: {} f:test.appstudio.openshift.io/snapshot-creation-report: {} f:finalizers: v:"test.appstudio.openshift.io/pipelinerun": {} f:labels: f:test.appstudio.openshift.io/pr-group-sha: {} manager: manager operation: Update time: "2025-11-06T05:42:44Z" - apiVersion: tekton.dev/v1 fieldsType: FieldsV1 fieldsV1: f:metadata: f:annotations: f:pipelinesascode.tekton.dev/scm-reporting-plr-started: {} f:finalizers: v:"pipelinesascode.tekton.dev/finalizer": {} f:spec: f:status: {} manager: pipelines-as-code-watcher operation: Update time: "2025-11-06T05:43:11Z" - apiVersion: tekton.dev/v1 fieldsType: FieldsV1 fieldsV1: f:metadata: f:annotations: f:pipelinesascode.tekton.dev/state: {} f:finalizers: v:"chains.tekton.dev/pipelinerun": {} f:labels: f:pipelinesascode.tekton.dev/state: {} f:tekton.dev/pipeline: {} manager: controller operation: Update time: "2025-11-06T05:43:15Z" - apiVersion: tekton.dev/v1 fieldsType: FieldsV1 fieldsV1: f:status: .: {} f:childReferences: {} f:completionTime: {} f:conditions: {} f:pipelineSpec: .: {} f:description: {} f:params: {} f:results: {} f:tasks: {} f:workspaces: {} f:provenance: .: {} f:featureFlags: .: {} f:awaitSidecarReadiness: {} f:coschedule: {} f:enableAPIFields: {} f:enableParamEnum: {} f:enableProvenanceInStatus: {} f:enforceNonfalsifiability: {} f:maxResultSize: {} f:resultExtractionMethod: {} f:runningInEnvWithInjectedSidecars: {} f:verificationNoMatchPolicy: {} f:results: {} f:skippedTasks: {} f:spanContext: .: {} f:traceparent: {} f:startTime: {} manager: controller operation: Update subresource: status time: "2025-11-06T05:49:58Z" name: konflux-demo-component-kbyv-on-push-z779z namespace: konflux-uedl resourceVersion: "83714" uid: 24c85c3a-7343-4aa2-a2eb-114a3c2e34c3 spec: params: - name: git-url value: https://github.com/redhat-appstudio-qe/hacbs-test-project-konflux-demo - name: revision value: 4e1fc4d5bd2ea44f727397aed092519e6b183a13 - name: output-image value: quay.io/redhat-appstudio-qe/konflux-uedl/konflux-demo-component-kbyv:4e1fc4d5bd2ea44f727397aed092519e6b183a13 - name: dockerfile value: Dockerfile pipelineSpec: description: | This pipeline is ideal for building container images from a Containerfile while maintaining trust after pipeline customization. _Uses `buildah` to create a container image leveraging [trusted artifacts](https://konflux-ci.dev/architecture/ADR/0036-trusted-artifacts.html). It also optionally creates a source image and runs some build-time tests. Information is shared between tasks using OCI artifacts instead of PVCs. EC will pass the [`trusted_task.trusted`](https://conforma.dev/docs/policy/packages/release_trusted_task.html#trusted_task__trusted) policy as long as all data used to build the artifact is generated from trusted tasks. This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/repository/konflux-ci/tekton-catalog/pipeline-docker-build-oci-ta?tab=tags)_ params: - description: Source Repository URL name: git-url type: string - default: "" description: Revision of the Source Repository name: revision type: string - description: Fully Qualified Output Image name: output-image type: string - default: . description: Path to the source code of an application's component from where to build image. name: path-context type: string - default: Dockerfile description: Path to the Dockerfile inside the context specified by parameter path-context name: dockerfile type: string - default: "false" description: Force rebuild image name: rebuild type: string - default: "false" description: Skip checks against built image name: skip-checks type: string - default: "false" description: Execute the build with network isolation name: hermetic type: string - default: "" description: Build dependencies to be prefetched name: prefetch-input type: string - default: "" description: Image tag expiration time, time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively. name: image-expires-after type: string - default: "false" description: Build a source image. name: build-source-image type: string - default: "false" description: Add built image into an OCI image index name: build-image-index type: string - default: docker description: The format for the resulting image's mediaType. Valid values are oci or docker. name: buildah-format type: string - default: [] description: Array of --build-arg values ("arg=value" strings) for buildah name: build-args type: array - default: "" description: Path to a file with build arguments for buildah, see https://www.mankier.com/1/buildah-build#--build-arg-file name: build-args-file type: string - default: "false" description: Whether to enable privileged mode, should be used only with remote VMs name: privileged-nested type: string results: - description: "" name: IMAGE_URL value: $(tasks.build-image-index.results.IMAGE_URL) - description: "" name: IMAGE_DIGEST value: $(tasks.build-image-index.results.IMAGE_DIGEST) - description: "" name: CHAINS-GIT_URL value: $(tasks.clone-repository.results.url) - description: "" name: CHAINS-GIT_COMMIT value: $(tasks.clone-repository.results.commit) tasks: - name: init params: - name: image-url value: $(params.output-image) - name: rebuild value: $(params.rebuild) - name: skip-checks value: $(params.skip-checks) taskRef: params: - name: name value: init - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-init:0.2@sha256:3ca52e1d8885fc229bd9067275f44d5b21a9a609981d0324b525ddeca909bf10 - name: kind value: task resolver: bundles - name: clone-repository params: - name: url value: $(params.git-url) - name: revision value: $(params.revision) - name: ociStorage value: $(params.output-image).git - name: ociArtifactExpiresAfter value: $(params.image-expires-after) runAfter: - init taskRef: params: - name: name value: git-clone-oci-ta - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.1@sha256:3dc39eae48745a96097c07c577b944d6203a91c35d3f71d9ed5feab41d327a6a - name: kind value: task resolver: bundles when: - input: $(tasks.init.results.build) operator: in values: - "true" workspaces: - name: basic-auth workspace: git-auth - name: prefetch-dependencies params: - name: input value: $(params.prefetch-input) - name: SOURCE_ARTIFACT value: $(tasks.clone-repository.results.SOURCE_ARTIFACT) - name: ociStorage value: $(params.output-image).prefetch - name: ociArtifactExpiresAfter value: $(params.image-expires-after) runAfter: - clone-repository taskRef: params: - name: name value: prefetch-dependencies-oci-ta - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.2@sha256:0503f9313dfe70e4defda88a7226ec91a74af42198dccfa3280397d965aa16d6 - name: kind value: task resolver: bundles workspaces: - name: git-basic-auth workspace: git-auth - name: netrc workspace: netrc - name: build-container params: - name: IMAGE value: $(params.output-image) - name: DOCKERFILE value: $(params.dockerfile) - name: CONTEXT value: $(params.path-context) - name: HERMETIC value: $(params.hermetic) - name: PREFETCH_INPUT value: $(params.prefetch-input) - name: IMAGE_EXPIRES_AFTER value: $(params.image-expires-after) - name: COMMIT_SHA value: $(tasks.clone-repository.results.commit) - name: BUILD_ARGS value: - $(params.build-args[*]) - name: BUILD_ARGS_FILE value: $(params.build-args-file) - name: PRIVILEGED_NESTED value: $(params.privileged-nested) - name: SOURCE_URL value: $(tasks.clone-repository.results.url) - name: BUILDAH_FORMAT value: $(params.buildah-format) - name: SOURCE_ARTIFACT value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) - name: CACHI2_ARTIFACT value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) runAfter: - prefetch-dependencies taskRef: params: - name: name value: buildah-oci-ta - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.6@sha256:104b14564927e973ae1dae2a8be8d35088dcbced7ba9fbde539e09e78fec142d - name: kind value: task resolver: bundles when: - input: $(tasks.init.results.build) operator: in values: - "true" - name: build-image-index params: - name: IMAGE value: $(params.output-image) - name: COMMIT_SHA value: $(tasks.clone-repository.results.commit) - name: IMAGE_EXPIRES_AFTER value: $(params.image-expires-after) - name: ALWAYS_BUILD_INDEX value: $(params.build-image-index) - name: IMAGES value: - $(tasks.build-container.results.IMAGE_URL)@$(tasks.build-container.results.IMAGE_DIGEST) - name: BUILDAH_FORMAT value: $(params.buildah-format) runAfter: - build-container taskRef: params: - name: name value: build-image-index - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.1@sha256:6978c3abadd6d86010b6fbb376cd6b69356bf6d4415a9a88af2d55e720ffa3ce - name: kind value: task resolver: bundles when: - input: $(tasks.init.results.build) operator: in values: - "true" - name: build-source-image params: - name: BINARY_IMAGE value: $(tasks.build-image-index.results.IMAGE_URL) - name: BINARY_IMAGE_DIGEST value: $(tasks.build-image-index.results.IMAGE_DIGEST) - name: SOURCE_ARTIFACT value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) - name: CACHI2_ARTIFACT value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) runAfter: - build-image-index taskRef: params: - name: name value: source-build-oci-ta - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3@sha256:282cb5a9119a87e88559444feff67d76d6f356d03654b4845632c049b2314735 - name: kind value: task resolver: bundles when: - input: $(tasks.init.results.build) operator: in values: - "true" - input: $(params.build-source-image) operator: in values: - "true" - name: deprecated-base-image-check params: - name: IMAGE_URL value: $(tasks.build-image-index.results.IMAGE_URL) - name: IMAGE_DIGEST value: $(tasks.build-image-index.results.IMAGE_DIGEST) runAfter: - build-image-index taskRef: params: - name: name value: deprecated-image-check - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:f59175d9a0a60411738228dfe568af4684af4aa5e7e05c832927cb917801d489 - name: kind value: task resolver: bundles when: - input: $(params.skip-checks) operator: in values: - "false" - name: clair-scan params: - name: image-digest value: $(tasks.build-image-index.results.IMAGE_DIGEST) - name: image-url value: $(tasks.build-image-index.results.IMAGE_URL) runAfter: - build-image-index taskRef: params: - name: name value: clair-scan - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:8ec7d7b9438ace5ef3fb03a533d9440d0fd81e51c73b0dc1eb51602fb7cd044e - name: kind value: task resolver: bundles when: - input: $(params.skip-checks) operator: in values: - "false" - name: ecosystem-cert-preflight-checks params: - name: image-url value: $(tasks.build-image-index.results.IMAGE_URL) runAfter: - build-image-index taskRef: params: - name: name value: ecosystem-cert-preflight-checks - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:9568c51a5158d534248908b9b561cf67d2826ed4ea164ffd95628bb42380e6ec - name: kind value: task resolver: bundles when: - input: $(params.skip-checks) operator: in values: - "false" - name: sast-snyk-check params: - name: image-digest value: $(tasks.build-image-index.results.IMAGE_DIGEST) - name: image-url value: $(tasks.build-image-index.results.IMAGE_URL) - name: SOURCE_ARTIFACT value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) - name: CACHI2_ARTIFACT value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) runAfter: - build-image-index taskRef: params: - name: name value: sast-snyk-check-oci-ta - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.4@sha256:60f2dac41844d222086ff7f477e51f3563716b183d87db89f603d6f604c21760 - name: kind value: task resolver: bundles when: - input: $(params.skip-checks) operator: in values: - "false" - name: clamav-scan params: - name: image-digest value: $(tasks.build-image-index.results.IMAGE_DIGEST) - name: image-url value: $(tasks.build-image-index.results.IMAGE_URL) runAfter: - build-image-index taskRef: params: - name: name value: clamav-scan - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:f3d2d179cddcc07d0228d9f52959a233037a3afa2619d0a8b2effbb467db80c3 - name: kind value: task resolver: bundles when: - input: $(params.skip-checks) operator: in values: - "false" - name: sast-coverity-check params: - name: image-digest value: $(tasks.build-image-index.results.IMAGE_DIGEST) - name: image-url value: $(tasks.build-image-index.results.IMAGE_URL) - name: IMAGE value: $(params.output-image) - name: DOCKERFILE value: $(params.dockerfile) - name: CONTEXT value: $(params.path-context) - name: HERMETIC value: $(params.hermetic) - name: PREFETCH_INPUT value: $(params.prefetch-input) - name: IMAGE_EXPIRES_AFTER value: $(params.image-expires-after) - name: COMMIT_SHA value: $(tasks.clone-repository.results.commit) - name: BUILD_ARGS value: - $(params.build-args[*]) - name: BUILD_ARGS_FILE value: $(params.build-args-file) - name: SOURCE_ARTIFACT value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) - name: CACHI2_ARTIFACT value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) runAfter: - coverity-availability-check taskRef: params: - name: name value: sast-coverity-check-oci-ta - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-sast-coverity-check-oci-ta:0.3@sha256:ae62d14c999fd93246fef4e57d28570fa5200c3266b9a3263a39965e5a5b02d7 - name: kind value: task resolver: bundles when: - input: $(params.skip-checks) operator: in values: - "false" - input: $(tasks.coverity-availability-check.results.STATUS) operator: in values: - success - name: coverity-availability-check runAfter: - build-image-index taskRef: params: - name: name value: coverity-availability-check - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-coverity-availability-check:0.2@sha256:5623e48314ffd583e9cab383011dc0763b6c92b09c4f427b8bfcca885394a21c - name: kind value: task resolver: bundles when: - input: $(params.skip-checks) operator: in values: - "false" - name: sast-shell-check params: - name: image-digest value: $(tasks.build-image-index.results.IMAGE_DIGEST) - name: image-url value: $(tasks.build-image-index.results.IMAGE_URL) - name: SOURCE_ARTIFACT value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) - name: CACHI2_ARTIFACT value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) runAfter: - build-image-index taskRef: params: - name: name value: sast-shell-check-oci-ta - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:1f0fcba24ebc447d9f8a2ea2e8f262fa435d6c523ca6b0346cd67261551fc9ed - name: kind value: task resolver: bundles when: - input: $(params.skip-checks) operator: in values: - "false" - name: sast-unicode-check params: - name: image-digest value: $(tasks.build-image-index.results.IMAGE_DIGEST) - name: image-url value: $(tasks.build-image-index.results.IMAGE_URL) - name: SOURCE_ARTIFACT value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) - name: CACHI2_ARTIFACT value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) runAfter: - build-image-index taskRef: params: - name: name value: sast-unicode-check-oci-ta - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.3@sha256:1833c618170ab9deb8455667f220df8e88d16ccd630a2361366f594e2bdcb712 - name: kind value: task resolver: bundles when: - input: $(params.skip-checks) operator: in values: - "false" - name: apply-tags params: - name: IMAGE_URL value: $(tasks.build-image-index.results.IMAGE_URL) - name: IMAGE_DIGEST value: $(tasks.build-image-index.results.IMAGE_DIGEST) runAfter: - build-image-index taskRef: params: - name: name value: apply-tags - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.2@sha256:55fc1eded400e29ff47eccd212ca42461c7e614b8ce3448d6482f9ae84b0e6cd - name: kind value: task resolver: bundles - name: push-dockerfile params: - name: IMAGE value: $(tasks.build-image-index.results.IMAGE_URL) - name: IMAGE_DIGEST value: $(tasks.build-image-index.results.IMAGE_DIGEST) - name: DOCKERFILE value: $(params.dockerfile) - name: CONTEXT value: $(params.path-context) - name: SOURCE_ARTIFACT value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) runAfter: - build-image-index taskRef: params: - name: name value: push-dockerfile-oci-ta - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.1@sha256:13633d5ba8445c0f732a0a5d1b33ffbb708398e45ef1647542b0ab22fee25a6a - name: kind value: task resolver: bundles - name: rpms-signature-scan params: - name: image-url value: $(tasks.build-image-index.results.IMAGE_URL) - name: image-digest value: $(tasks.build-image-index.results.IMAGE_DIGEST) runAfter: - build-image-index taskRef: params: - name: name value: rpms-signature-scan - name: bundle value: quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2@sha256:3d016c63bcab64ab82da762a52b013c0bcb534e9523b8c0e073cc3a0c02f0cac - name: kind value: task resolver: bundles when: - input: $(params.skip-checks) operator: in values: - "false" workspaces: - name: git-auth optional: true - name: netrc optional: true taskRunTemplate: podTemplate: nodeSelector: konflux-ci.dev/workload: konflux-tenants tolerations: - effect: NoSchedule key: konflux-ci.dev/workload operator: Equal value: konflux-tenants serviceAccountName: build-pipeline-konflux-demo-component-kbyv timeouts: pipeline: 2h0m0s workspaces: - name: git-auth secret: secretName: pac-gitauth-nimlvl status: childReferences: - apiVersion: tekton.dev/v1 kind: TaskRun name: konflux-demo-component-kbyv-on-push-z779z-init pipelineTaskName: init - apiVersion: tekton.dev/v1 kind: TaskRun name: konflux-demo-component-kbyv-on-push-z779z-clone-repository pipelineTaskName: clone-repository whenExpressions: - input: "true" operator: in values: - "true" - apiVersion: tekton.dev/v1 kind: TaskRun name: konflux-demo-component-kbyv-on-push-z779z-prefetch-dependencies pipelineTaskName: prefetch-dependencies - apiVersion: tekton.dev/v1 kind: TaskRun name: konflux-demo-component-kbyv-on-push-z779z-build-container pipelineTaskName: build-container whenExpressions: - input: "true" operator: in values: - "true" - apiVersion: tekton.dev/v1 kind: TaskRun name: konflux-demo-component-kbyv-on-push-z779z-build-image-index pipelineTaskName: build-image-index whenExpressions: - input: "true" operator: in values: - "true" - apiVersion: tekton.dev/v1 kind: TaskRun name: konbde718a19a8881fc8fef8cc0d217dcf0-deprecated-base-image-check pipelineTaskName: deprecated-base-image-check whenExpressions: - input: "false" operator: in values: - "false" - apiVersion: tekton.dev/v1 kind: TaskRun name: konflux-demo-component-kbyv-on-push-z779z-clair-scan pipelineTaskName: clair-scan whenExpressions: - input: "false" operator: in values: - "false" - apiVersion: tekton.dev/v1 kind: TaskRun name: konflux-demo-component-kbyv-on-8c65a992d312cafeddbeddde393a67be pipelineTaskName: ecosystem-cert-preflight-checks whenExpressions: - input: "false" operator: in values: - "false" - apiVersion: tekton.dev/v1 kind: TaskRun name: konflux-demo-component-kbyv-on-push-z779z-sast-snyk-check pipelineTaskName: sast-snyk-check whenExpressions: - input: "false" operator: in values: - "false" - apiVersion: tekton.dev/v1 kind: TaskRun name: konflux-demo-component-kbyv-on-push-z779z-clamav-scan pipelineTaskName: clamav-scan whenExpressions: - input: "false" operator: in values: - "false" - apiVersion: tekton.dev/v1 kind: TaskRun name: konbde718a19a8881fc8fef8cc0d217dcf0-coverity-availability-check pipelineTaskName: coverity-availability-check whenExpressions: - input: "false" operator: in values: - "false" - apiVersion: tekton.dev/v1 kind: TaskRun name: konflux-demo-component-kbyv-on-push-z779z-sast-shell-check pipelineTaskName: sast-shell-check whenExpressions: - input: "false" operator: in values: - "false" - apiVersion: tekton.dev/v1 kind: TaskRun name: konflux-demo-component-kbyv-on-push-z779z-sast-unicode-check pipelineTaskName: sast-unicode-check whenExpressions: - input: "false" operator: in values: - "false" - apiVersion: tekton.dev/v1 kind: TaskRun name: konflux-demo-component-kbyv-on-push-z779z-apply-tags pipelineTaskName: apply-tags - apiVersion: tekton.dev/v1 kind: TaskRun name: konflux-demo-component-kbyv-on-push-z779z-push-dockerfile pipelineTaskName: push-dockerfile - apiVersion: tekton.dev/v1 kind: TaskRun name: konflux-demo-component-kbyv-on-push-z779z-rpms-signature-scan pipelineTaskName: rpms-signature-scan whenExpressions: - input: "false" operator: in values: - "false" completionTime: "2025-11-06T05:49:58Z" conditions: - lastTransitionTime: "2025-11-06T05:49:58Z" message: 'Tasks Completed: 16 (Failed: 1, Cancelled 0), Skipped: 2' reason: Failed status: "False" type: Succeeded pipelineSpec: description: | This pipeline is ideal for building container images from a Containerfile while maintaining trust after pipeline customization. _Uses `buildah` to create a container image leveraging [trusted artifacts](https://konflux-ci.dev/architecture/ADR/0036-trusted-artifacts.html). It also optionally creates a source image and runs some build-time tests. Information is shared between tasks using OCI artifacts instead of PVCs. EC will pass the [`trusted_task.trusted`](https://conforma.dev/docs/policy/packages/release_trusted_task.html#trusted_task__trusted) policy as long as all data used to build the artifact is generated from trusted tasks. This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/repository/konflux-ci/tekton-catalog/pipeline-docker-build-oci-ta?tab=tags)_ params: - description: Source Repository URL name: git-url type: string - default: "" description: Revision of the Source Repository name: revision type: string - description: Fully Qualified Output Image name: output-image type: string - default: . description: Path to the source code of an application's component from where to build image. name: path-context type: string - default: Dockerfile description: Path to the Dockerfile inside the context specified by parameter path-context name: dockerfile type: string - default: "false" description: Force rebuild image name: rebuild type: string - default: "false" description: Skip checks against built image name: skip-checks type: string - default: "false" description: Execute the build with network isolation name: hermetic type: string - default: "" description: Build dependencies to be prefetched name: prefetch-input type: string - default: "" description: Image tag expiration time, time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively. name: image-expires-after type: string - default: "false" description: Build a source image. name: build-source-image type: string - default: "false" description: Add built image into an OCI image index name: build-image-index type: string - default: docker description: The format for the resulting image's mediaType. Valid values are oci or docker. name: buildah-format type: string - default: [] description: Array of --build-arg values ("arg=value" strings) for buildah name: build-args type: array - default: "" description: Path to a file with build arguments for buildah, see https://www.mankier.com/1/buildah-build#--build-arg-file name: build-args-file type: string - default: "false" description: Whether to enable privileged mode, should be used only with remote VMs name: privileged-nested type: string results: - description: "" name: IMAGE_URL value: $(tasks.build-image-index.results.IMAGE_URL) - description: "" name: IMAGE_DIGEST value: $(tasks.build-image-index.results.IMAGE_DIGEST) - description: "" name: CHAINS-GIT_URL value: $(tasks.clone-repository.results.url) - description: "" name: CHAINS-GIT_COMMIT value: $(tasks.clone-repository.results.commit) tasks: - name: init params: - name: image-url value: quay.io/redhat-appstudio-qe/konflux-uedl/konflux-demo-component-kbyv:4e1fc4d5bd2ea44f727397aed092519e6b183a13 - name: rebuild value: "false" - name: skip-checks value: "false" taskRef: params: - name: name value: init - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-init:0.2@sha256:3ca52e1d8885fc229bd9067275f44d5b21a9a609981d0324b525ddeca909bf10 - name: kind value: task resolver: bundles - name: clone-repository params: - name: url value: https://github.com/redhat-appstudio-qe/hacbs-test-project-konflux-demo - name: revision value: 4e1fc4d5bd2ea44f727397aed092519e6b183a13 - name: ociStorage value: quay.io/redhat-appstudio-qe/konflux-uedl/konflux-demo-component-kbyv:4e1fc4d5bd2ea44f727397aed092519e6b183a13.git - name: ociArtifactExpiresAfter value: "" runAfter: - init taskRef: params: - name: name value: git-clone-oci-ta - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.1@sha256:3dc39eae48745a96097c07c577b944d6203a91c35d3f71d9ed5feab41d327a6a - name: kind value: task resolver: bundles when: - input: $(tasks.init.results.build) operator: in values: - "true" workspaces: - name: basic-auth workspace: git-auth - name: prefetch-dependencies params: - name: input value: "" - name: SOURCE_ARTIFACT value: $(tasks.clone-repository.results.SOURCE_ARTIFACT) - name: ociStorage value: quay.io/redhat-appstudio-qe/konflux-uedl/konflux-demo-component-kbyv:4e1fc4d5bd2ea44f727397aed092519e6b183a13.prefetch - name: ociArtifactExpiresAfter value: "" runAfter: - clone-repository taskRef: params: - name: name value: prefetch-dependencies-oci-ta - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.2@sha256:0503f9313dfe70e4defda88a7226ec91a74af42198dccfa3280397d965aa16d6 - name: kind value: task resolver: bundles workspaces: - name: git-basic-auth workspace: git-auth - name: netrc workspace: netrc - name: build-container params: - name: IMAGE value: quay.io/redhat-appstudio-qe/konflux-uedl/konflux-demo-component-kbyv:4e1fc4d5bd2ea44f727397aed092519e6b183a13 - name: DOCKERFILE value: Dockerfile - name: CONTEXT value: . - name: HERMETIC value: "false" - name: PREFETCH_INPUT value: "" - name: IMAGE_EXPIRES_AFTER value: "" - name: COMMIT_SHA value: $(tasks.clone-repository.results.commit) - name: BUILD_ARGS value: [] - name: BUILD_ARGS_FILE value: "" - name: PRIVILEGED_NESTED value: "false" - name: SOURCE_URL value: $(tasks.clone-repository.results.url) - name: BUILDAH_FORMAT value: docker - name: SOURCE_ARTIFACT value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) - name: CACHI2_ARTIFACT value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) runAfter: - prefetch-dependencies taskRef: params: - name: name value: buildah-oci-ta - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.6@sha256:104b14564927e973ae1dae2a8be8d35088dcbced7ba9fbde539e09e78fec142d - name: kind value: task resolver: bundles when: - input: $(tasks.init.results.build) operator: in values: - "true" - name: build-image-index params: - name: IMAGE value: quay.io/redhat-appstudio-qe/konflux-uedl/konflux-demo-component-kbyv:4e1fc4d5bd2ea44f727397aed092519e6b183a13 - name: COMMIT_SHA value: $(tasks.clone-repository.results.commit) - name: IMAGE_EXPIRES_AFTER value: "" - name: ALWAYS_BUILD_INDEX value: "false" - name: IMAGES value: - $(tasks.build-container.results.IMAGE_URL)@$(tasks.build-container.results.IMAGE_DIGEST) - name: BUILDAH_FORMAT value: docker runAfter: - build-container taskRef: params: - name: name value: build-image-index - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.1@sha256:6978c3abadd6d86010b6fbb376cd6b69356bf6d4415a9a88af2d55e720ffa3ce - name: kind value: task resolver: bundles when: - input: $(tasks.init.results.build) operator: in values: - "true" - name: build-source-image params: - name: BINARY_IMAGE value: $(tasks.build-image-index.results.IMAGE_URL) - name: BINARY_IMAGE_DIGEST value: $(tasks.build-image-index.results.IMAGE_DIGEST) - name: SOURCE_ARTIFACT value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) - name: CACHI2_ARTIFACT value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) runAfter: - build-image-index taskRef: params: - name: name value: source-build-oci-ta - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3@sha256:282cb5a9119a87e88559444feff67d76d6f356d03654b4845632c049b2314735 - name: kind value: task resolver: bundles when: - input: $(tasks.init.results.build) operator: in values: - "true" - input: "false" operator: in values: - "true" - name: deprecated-base-image-check params: - name: IMAGE_URL value: $(tasks.build-image-index.results.IMAGE_URL) - name: IMAGE_DIGEST value: $(tasks.build-image-index.results.IMAGE_DIGEST) runAfter: - build-image-index taskRef: params: - name: name value: deprecated-image-check - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:f59175d9a0a60411738228dfe568af4684af4aa5e7e05c832927cb917801d489 - name: kind value: task resolver: bundles when: - input: "false" operator: in values: - "false" - name: clair-scan params: - name: image-digest value: $(tasks.build-image-index.results.IMAGE_DIGEST) - name: image-url value: $(tasks.build-image-index.results.IMAGE_URL) runAfter: - build-image-index taskRef: params: - name: name value: clair-scan - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:8ec7d7b9438ace5ef3fb03a533d9440d0fd81e51c73b0dc1eb51602fb7cd044e - name: kind value: task resolver: bundles when: - input: "false" operator: in values: - "false" - name: ecosystem-cert-preflight-checks params: - name: image-url value: $(tasks.build-image-index.results.IMAGE_URL) runAfter: - build-image-index taskRef: params: - name: name value: ecosystem-cert-preflight-checks - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:9568c51a5158d534248908b9b561cf67d2826ed4ea164ffd95628bb42380e6ec - name: kind value: task resolver: bundles when: - input: "false" operator: in values: - "false" - name: sast-snyk-check params: - name: image-digest value: $(tasks.build-image-index.results.IMAGE_DIGEST) - name: image-url value: $(tasks.build-image-index.results.IMAGE_URL) - name: SOURCE_ARTIFACT value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) - name: CACHI2_ARTIFACT value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) runAfter: - build-image-index taskRef: params: - name: name value: sast-snyk-check-oci-ta - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.4@sha256:60f2dac41844d222086ff7f477e51f3563716b183d87db89f603d6f604c21760 - name: kind value: task resolver: bundles when: - input: "false" operator: in values: - "false" - name: clamav-scan params: - name: image-digest value: $(tasks.build-image-index.results.IMAGE_DIGEST) - name: image-url value: $(tasks.build-image-index.results.IMAGE_URL) runAfter: - build-image-index taskRef: params: - name: name value: clamav-scan - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:f3d2d179cddcc07d0228d9f52959a233037a3afa2619d0a8b2effbb467db80c3 - name: kind value: task resolver: bundles when: - input: "false" operator: in values: - "false" - name: sast-coverity-check params: - name: image-digest value: $(tasks.build-image-index.results.IMAGE_DIGEST) - name: image-url value: $(tasks.build-image-index.results.IMAGE_URL) - name: IMAGE value: quay.io/redhat-appstudio-qe/konflux-uedl/konflux-demo-component-kbyv:4e1fc4d5bd2ea44f727397aed092519e6b183a13 - name: DOCKERFILE value: Dockerfile - name: CONTEXT value: . - name: HERMETIC value: "false" - name: PREFETCH_INPUT value: "" - name: IMAGE_EXPIRES_AFTER value: "" - name: COMMIT_SHA value: $(tasks.clone-repository.results.commit) - name: BUILD_ARGS value: [] - name: BUILD_ARGS_FILE value: "" - name: SOURCE_ARTIFACT value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) - name: CACHI2_ARTIFACT value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) runAfter: - coverity-availability-check taskRef: params: - name: name value: sast-coverity-check-oci-ta - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-sast-coverity-check-oci-ta:0.3@sha256:ae62d14c999fd93246fef4e57d28570fa5200c3266b9a3263a39965e5a5b02d7 - name: kind value: task resolver: bundles when: - input: "false" operator: in values: - "false" - input: $(tasks.coverity-availability-check.results.STATUS) operator: in values: - success - name: coverity-availability-check runAfter: - build-image-index taskRef: params: - name: name value: coverity-availability-check - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-coverity-availability-check:0.2@sha256:5623e48314ffd583e9cab383011dc0763b6c92b09c4f427b8bfcca885394a21c - name: kind value: task resolver: bundles when: - input: "false" operator: in values: - "false" - name: sast-shell-check params: - name: image-digest value: $(tasks.build-image-index.results.IMAGE_DIGEST) - name: image-url value: $(tasks.build-image-index.results.IMAGE_URL) - name: SOURCE_ARTIFACT value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) - name: CACHI2_ARTIFACT value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) runAfter: - build-image-index taskRef: params: - name: name value: sast-shell-check-oci-ta - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:1f0fcba24ebc447d9f8a2ea2e8f262fa435d6c523ca6b0346cd67261551fc9ed - name: kind value: task resolver: bundles when: - input: "false" operator: in values: - "false" - name: sast-unicode-check params: - name: image-digest value: $(tasks.build-image-index.results.IMAGE_DIGEST) - name: image-url value: $(tasks.build-image-index.results.IMAGE_URL) - name: SOURCE_ARTIFACT value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) - name: CACHI2_ARTIFACT value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) runAfter: - build-image-index taskRef: params: - name: name value: sast-unicode-check-oci-ta - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.3@sha256:1833c618170ab9deb8455667f220df8e88d16ccd630a2361366f594e2bdcb712 - name: kind value: task resolver: bundles when: - input: "false" operator: in values: - "false" - name: apply-tags params: - name: IMAGE_URL value: $(tasks.build-image-index.results.IMAGE_URL) - name: IMAGE_DIGEST value: $(tasks.build-image-index.results.IMAGE_DIGEST) runAfter: - build-image-index taskRef: params: - name: name value: apply-tags - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.2@sha256:55fc1eded400e29ff47eccd212ca42461c7e614b8ce3448d6482f9ae84b0e6cd - name: kind value: task resolver: bundles - name: push-dockerfile params: - name: IMAGE value: $(tasks.build-image-index.results.IMAGE_URL) - name: IMAGE_DIGEST value: $(tasks.build-image-index.results.IMAGE_DIGEST) - name: DOCKERFILE value: Dockerfile - name: CONTEXT value: . - name: SOURCE_ARTIFACT value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) runAfter: - build-image-index taskRef: params: - name: name value: push-dockerfile-oci-ta - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.1@sha256:13633d5ba8445c0f732a0a5d1b33ffbb708398e45ef1647542b0ab22fee25a6a - name: kind value: task resolver: bundles - name: rpms-signature-scan params: - name: image-url value: $(tasks.build-image-index.results.IMAGE_URL) - name: image-digest value: $(tasks.build-image-index.results.IMAGE_DIGEST) runAfter: - build-image-index taskRef: params: - name: name value: rpms-signature-scan - name: bundle value: quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2@sha256:3d016c63bcab64ab82da762a52b013c0bcb534e9523b8c0e073cc3a0c02f0cac - name: kind value: task resolver: bundles when: - input: "false" operator: in values: - "false" workspaces: - name: git-auth optional: true - name: netrc optional: true provenance: featureFlags: AwaitSidecarReadiness: false Coschedule: "" DisableAffinityAssistant: false DisableCredsInit: false DisableInlineSpec: "" EnableAPIFields: "" EnableArtifacts: false EnableCELInWhenExpression: false EnableConciseResolverSyntax: false EnableKeepPodOnCancel: false EnableKubernetesSidecar: false EnableParamEnum: false EnableProvenanceInStatus: false EnableStepActions: false EnforceNonfalsifiability: "" MaxResultSize: 0 RequireGitSSHSecretKnownHosts: false ResultExtractionMethod: "" RunningInEnvWithInjectedSidecars: false SendCloudEventsForRuns: false SetSecurityContext: false VerificationNoMatchPolicy: "" results: - name: IMAGE_URL value: quay.io/redhat-appstudio-qe/konflux-uedl/konflux-demo-component-kbyv:4e1fc4d5bd2ea44f727397aed092519e6b183a13 - name: IMAGE_DIGEST value: sha256:082506748acbeb9c0078720e52fd346a0691ec8e833914268c2e6c541b6f33d7 - name: CHAINS-GIT_URL value: https://github.com/redhat-appstudio-qe/hacbs-test-project-konflux-demo - name: CHAINS-GIT_COMMIT value: 4e1fc4d5bd2ea44f727397aed092519e6b183a13 skippedTasks: - name: build-source-image reason: PipelineRun was stopping whenExpressions: - input: "true" operator: in values: - "true" - input: "false" operator: in values: - "true" - name: sast-coverity-check reason: PipelineRun was stopping whenExpressions: - input: "false" operator: in values: - "false" - input: failed operator: in values: - success spanContext: traceparent: 00-0847aa83f94b48933cbe4955c556784c-a13d146bec6a6dbc-01 startTime: "2025-11-06T05:42:44Z"